Page MenuHomeVyOS Platform
Create Task
Maniphest T7707

VPP add the vpp-crypto-engines dependency for IPSec
Closed, ResolvedPublicBUG
Actions

Description

Summary

VPP add the vpp-crypto-engines dependency for IPSec

Without the vpp-crypto-engines VPP cannot handle IPsec SAs

[Example: "802.1q VLAN interfaces are widely used for traffic separation in switched networks and for "router on a stick" scenarios. Most router vendors support them.]

Additional information

Example:

set interfaces ethernet eth0 address '10.0.0.2/30'
set interfaces ethernet eth0 description 'WAN'
set system host-name 'vpp-right'
set system option kernel memory default-hugepage-size '2M'
set system option kernel memory hugepage-size 2M hugepage-count '1800'
set vpn ipsec authentication psk PSK id '10.0.0.1'
set vpn ipsec authentication psk PSK id '10.0.0.2'
set vpn ipsec authentication psk PSK secret '1234567890'
set vpn ipsec esp-group ESP-group lifetime '3600'
set vpn ipsec esp-group ESP-group mode 'tunnel'
set vpn ipsec esp-group ESP-group pfs 'enable'
set vpn ipsec esp-group ESP-group proposal 1 encryption 'aes256'
set vpn ipsec esp-group ESP-group proposal 1 hash 'sha256'
set vpn ipsec ike-group IKE-group key-exchange 'ikev2'
set vpn ipsec ike-group IKE-group lifetime '28800'
set vpn ipsec ike-group IKE-group proposal 1 encryption 'aes256'
set vpn ipsec ike-group IKE-group proposal 1 hash 'sha1'
set vpn ipsec interface 'eth0'
set vpn ipsec site-to-site peer LEFT authentication local-id '10.0.0.2'
set vpn ipsec site-to-site peer LEFT authentication mode 'pre-shared-secret'
set vpn ipsec site-to-site peer LEFT authentication remote-id '10.0.0.1'
set vpn ipsec site-to-site peer LEFT connection-type 'respond'
set vpn ipsec site-to-site peer LEFT ike-group 'IKE-group'
set vpn ipsec site-to-site peer LEFT local-address '10.0.0.2'
set vpn ipsec site-to-site peer LEFT remote-address '10.0.0.1'
set vpn ipsec site-to-site peer LEFT tunnel 0 esp-group 'ESP-group'
set vpn ipsec site-to-site peer LEFT tunnel 0 local prefix '100.64.2.0/24'
set vpn ipsec site-to-site peer LEFT tunnel 0 remote prefix '100.64.1.0/24'
set vpp settings interface eth0 driver 'dpdk'
set vpp settings interface eth1 driver 'dpdk'
set vpp settings ipsec
set vpp settings unix poll-sleep-usec '120'

Log:

Aug 11 11:55:09 vpp-right charon-systemd[4688]: CHILD_SA LEFT-tunnel-0{2} established with SPIs cee67307_i ca45e459_o and TS 100.64.2.0/24 === 100.64.1.0/24
Aug 11 11:55:09 vpp-right vpp[1901]: linux-cp/ipsec: ipsec sa add cce6bfeb failure(err: -9) 10.0.0.1 -> 10.0.0.2
Aug 11 11:55:09 vpp-right vpp[1901]: ipsec_sa_add_and_lock:548: No crypto engine support for sha-256-128
Aug 11 11:55:09 vpp-right vpp[1901]: linux-cp/ipsec: ipsec sa add cb452f16 failure(err: -9) 10.0.0.2 -> 10.0.0.1

Details

Version
VyOS 2025.08.11-0022-rolling
Is it a breaking change?
Perfectly compatible
Issue type
Feature (new functionality)

Related Objects
Search...

StatusSubtypeAssignedTask
 ResolvedFEATURE REQUESTViacheslavT7692 VPP bump version to the stable 2506
 OpenBUGNoneT7070 VPP related bugs the root task
 ResolvedBUGViacheslavT7707 VPP add the vpp-crypto-engines dependency for IPSec

Event Timeline

Viacheslav created this task.Aug 11 2025, 12:14 PM
Viacheslav renamed this task from Add VPP dependency for IPSec vpp-crypto-engines to VPP add the vpp-crypto-engines dependency for IPSec .
Viacheslav updated the task description. (Show Details)
Viacheslav changed Version from - to VyOS 2025.08.11-0022-rolling.
Viacheslav changed the task status from Open to In progress.Aug 11 2025, 12:16 PM
Viacheslav claimed this task.
Viacheslav triaged this task as Normal priority.
Viacheslav changed the subtype of this task from "Feature Request" to "Bug".Aug 11 2025, 12:57 PM
Viacheslav added a parent task: T7070: VPP related bugs the root task.

PR https://github.com/vyos/vyos-1x/pull/4655

Viacheslav added a project: VyOS 1.5 Circinus (1.5-stream-2025-Q3).Aug 11 2025, 1:02 PM
Viacheslav mentioned this in rVYOSONEXd808793e278e: T7707: VPP add dependency vpp-crypto-engines required for IPsec.Aug 12 2025, 2:33 PM
Restricted Repository Identity mentioned this in rVYOSONEX98e0b88fde27: Merge pull request #4655 from sever-sever/T7707.Aug 12 2025, 2:33 PM
Viacheslav closed this task as Resolved.Aug 14 2025, 7:34 AM
Viacheslav moved this task from Need Triage to Completed on the VyOS Rolling board.
Viacheslav moved this task from Open to Finished on the VyOS 1.5 Circinus (1.5-stream-2025-Q3) board.
Viacheslav reopened this task as Open.Aug 14 2025, 9:12 AM

Re-opened, image still does not include this package

 DEBUG -  show version all | grep -e "vpp" -e "vyos-1x"
DEBUG - ii  libvppinfra                      25.06.0-21~g43212d8f7-dirty      amd64        Vector Packet Processing--runtime libraries
DEBUG - ii  libvppinfra-dev                  25.06.0-21~g43212d8f7-dirty      amd64        Vector Packet Processing--runtime libraries
DEBUG - ii  python3-vpp-api                  25.06.0-21~g43212d8f7-dirty      amd64        VPP Python3 API bindings
DEBUG - ii  vpp                              25.06.0-21~g43212d8f7-dirty      amd64        Vector Packet Processing--executables
DEBUG - ii  vpp-dev                          25.06.0-21~g43212d8f7-dirty      amd64        Vector Packet Processing--development support
DEBUG - ii  vpp-plugin-core                  25.06.0-21~g43212d8f7-dirty      amd64        Vector Packet Processing--runtime core plugins
DEBUG - ii  vpp-plugin-dpdk                  25.06.0-21~g43212d8f7-dirty      amd64        Vector Packet Processing--runtime dpdk plugin
DEBUG - ii  vyos-1x                          1.5dev0-3397-g33b13061b          amd64        VyOS configuration scripts and data
DEBUG - ii  vyos-1x-smoketest                1.5dev0-3397-g33b13061b          all          VyOS build sanity checking toolkit
DEBUG - vyos@vyos:~$ l
Viacheslav moved this task from Finished to Open on the VyOS 1.5 Circinus (1.5-stream-2025-Q3) board.Aug 14 2025, 9:12 AM
Viacheslav moved this task from Completed to Need Triage on the VyOS Rolling board.
Viacheslav added a comment.Aug 14 2025, 10:55 AM

Will be fixed in https://github.com/vyos/vyos-build/pull/1009

Viacheslav closed this task as Resolved.Aug 21 2025, 10:26 AM
Viacheslav moved this task from Need Triage to Completed on the VyOS Rolling board.
Viacheslav moved this task from Open to Finished on the VyOS 1.5 Circinus (1.5-stream-2025-Q3) board.
dmbaturin renamed this task from VPP add the vpp-crypto-engines dependency for IPSec to VPP add the vpp-crypto-engines dependency for IPSec.Nov 13 2025, 1:21 AM
dmbaturin edited projects, added: VyOS 1.5 Circinus (2025.11); removed: VyOS 1.5 Circinus (1.5-stream-2025-Q3), VyOS Rolling.
dmbaturin changed Is it a breaking change? from Unspecified (possibly destroys the router) to Perfectly compatible.